Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7115ac7f authored by Luke Nowakowski-Krijger's avatar Luke Nowakowski-Krijger Committed by Greg Kroah-Hartman
Browse files

media: hdpvr: Add device num check and handling 



[ Upstream commit d4a6a9537bc32811486282206ecfb7c53754b74d ]

Add hdpvr device num check and error handling

We need to increment the device count atomically before we checkout a
device to make sure that we do not reach the max count, otherwise we get
out-of-bounds errors as reported by syzbot.

Reported-and-tested-by: default avatar <syzbot+aac8d0d7205f112045d2@syzkaller.appspotmail.com>

Signed-off-by: default avatarLuke Nowakowski-Krijger <lnowakow@eng.ucsd.edu>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 9c52a1e7

drivers/media/usb/hdpvr/hdpvr-core.c

+11 −1
Original line number Diff line number Diff line
@@ -278,6 +278,7 @@ static int hdpvr_probe(struct usb_interface *interface, 
#endif

	size_t buffer_size;

	int i;

	int dev_num;

	int retval = -ENOMEM;



	/* allocate memory for our device state and initialize it */
@@ -382,8 +383,17 @@ static int hdpvr_probe(struct usb_interface *interface, 
	}

#endif



	dev_num = atomic_inc_return(&dev_nr);

	if (dev_num >= HDPVR_MAX) {

		v4l2_err(&dev->v4l2_dev,

			 "max device number reached, device register failed\n");

		atomic_dec(&dev_nr);

		retval = -ENODEV;

		goto reg_fail;

	}



	retval = hdpvr_register_videodev(dev, &interface->dev,

				    video_nr[atomic_inc_return(&dev_nr)]);

				    video_nr[dev_num]);

	if (retval < 0) {

		v4l2_err(&dev->v4l2_dev, "registering videodev failed\n");

		goto reg_fail;